Packet Filtering and Firewall Architecture

Flashcards covering packet filter mechanisms, firewall designs, stateful packet inspection, rule writing, and security zoning based on the lecture notes.

Packet Filter

A software solution that limits network connectivity based on packet characteristics such as source, destination, packet type, protocol, and ports.

Packet Filter OSI Location

The operational position of packet filtering within the network stack, described as running between Layers 2 and 3 in the OSI model.

Firewall

A dedicated router that contains a packet filter and is deployed as a dedicated security device between networks.

Dedicated Firewall

A hardware/software solution specifically dedicated to routing and filtering traffic, providing minimal to no unrelated network services.

General-Purpose Packet Filter Examples

Software filtering solutions such as pfSense and m0n0wall running on a general-purpose computer.

Dedicated Firewall Examples

Dedicated hardware and software routing/filtering platforms such as Cisco PIX/ASA and Juniper NetScreen.

Static Packet Filtering

The traditional, stateless packet-filtering approach that evaluates each packet individually and makes independent allow/deny decisions without connection context.

Dynamic Packet Filtering

State-aware filtering that evaluates both packet contents and the context or state of the traffic.

Stateful Packet Inspection (SPI)

The standard dynamic packet-filtering technology created by CheckPoint in 1993 that inspects connection states, sequence numbers, and TCP flags (SYN, FIN, ACK, NAK).

Rule Direction

The path of network traffic defined relative to the specific interface where a filtering rule is applied.

In (External Interface)

Traffic entering the external interface of a firewall from the outside.

Out (External Interface)

Traffic leaving the external interface of a firewall toward the outside from inside the network structure.

In (Internal Interface)

Traffic arriving at an internal interface from the internal network.

Out (Internal Interface)

Traffic leaving toward an internal interface from another network, such as the public network or a DMZ.

Inbound Traffic

Overall traffic flow arriving from an outside, external, or public interface and destined for an internal address.

Outbound Traffic

Overall traffic flow originating from an internal interface and destined for an external address.

Filtering Rule

A statement that matches traffic characteristics and specifies an action to perform, composed of a source match, destination match, and action.

Source Match

The characteristics of the originating side of network traffic that must match a filtering rule.

Destination Match

The characteristics of the receiving side of network traffic that must match a filtering rule.

Ruleset

A collection of filtering rules that collectively controls network access.

First-Match Algorithm

The rule-matching mechanism where the first rule matching a packet executes its action, immediately halting further rule evaluation.

Specific Host Match

A rule condition that matches exactly one host address, represented using a /32 mask such as 172.16.3.4/32.

Protocol Match

A rule condition identifying specific protocols such as IP, TCP, UDP, ICMP, IPsec, or GRE.

Protocol Detail Match

A rule condition that inspects additional protocol details such as port numbers or ICMP types and codes.

Typical TCP/UDP Source Port Behavior

For outgoing connections, the source port is generally randomly selected from ports above 1023.

Allow / Permit Action

A filtering rule action that allows matching traffic to pass through the device.

Deny / Drop Action

A filtering rule action that silently discards the matching packet without sending a response, causing the sender's connection to time out.

Reject Action

A filtering rule action that blocks the packet and explicitly notifies the sender by sending an ICMP port administratively unreachable message.

Firewall Security Zone

A defined network area with a specific security purpose and trust relationship, primarily divided into Public, Private, and DMZ.

Public Zone

The external security zone representing the Internet, accessed either directly or through an ISP.

Private Zone

An organization's internal network zone that is intended to have minimal direct access to the Internet.

DMZ (Demilitarized Zone)

A network security zone with limited access to both the Internet and private networks, providing a controlled location for systems interacting with Internet hosts.

DMZ Service Isolation Best Practice

A network security practice where each service deployed within the DMZ is placed on an independent machine.

Outer DMZ

An Internet-facing DMZ that directly provides services to Internet hosts using valid Internet-reachable addressing or NAT.

SNAT

Source Network Address Translation; an inter-network process that modifies the source address of packets moving across interfaces.

DNAT

Destination Network Address Translation; an inter-network process associated with port forwarding that modifies the destination address of packets.

RFC 1918

The standard defining private IPv4 address space used for internal networks and secondary DMZs.

Ingress Filtering

The security practice of evaluating and filtering packets as they enter a network device or interface.

Egress Filtering

The practice of evaluating and filtering packets as they leave a network device or interface.

Filter-Once Best Practice

A design guideline stating that a particular traffic match should be filtered only once rather than checking the same traffic on ingress and egress.

General Ruleset Structure

The standard ordering strategy where deny exceptions to allow rules are placed first, followed by broad allow rules, and completed with a deny-all rule.

Deny All

A final rule placed at the end of a ruleset that blocks all traffic that has not matched any preceding allow rule.

Default Deny Philosophy

The security model where only explicitly authorized traffic is permitted, and all other traffic is denied by default.

Technology-Specific Filtering Syntax

The vendor- or platform-specific configuration commands (such as pfSense, IPTables, or PIX/ASA) used to implement logical rules.